BMC Communities: Message List - RSCD log for a yearhttps://communities.bmc.com/community/bmcdn/truesight-server-automation?view=discussions
Most recent forum messagesenThu, 24 Jun 2010 16:58:14 GMTJive Engage 8.0.2.1 (http://jivesoftware.com/products/)2010-06-24T16:58:14ZenRe: RSCD log for a yearhttps://communities.bmc.com/message/153415?tstart=0#153415
<!-- [DocumentBodyStart:adc5e505-c38f-4a4a-9d2d-886f63955b3b] --><div class="jive-rendered-content"><p>You need to update bsara w/ the agentlogs path too, I'm not sure how though...probably in the docs.</p><p style="min-height: 8pt; padding: 0px;">&#160;</p><p>Keystroke logs, I'm not as sure, I'd say take snapshots but you won't get the same functionality you get w/ the agent logs.</p></div><!-- [DocumentBodyEnd:adc5e505-c38f-4a4a-9d2d-886f63955b3b] --><img src='/beacon?t=1548101258204' />Thu, 24 Jun 2010 16:58:14 GMTcommunities_update@bmc.comhttps://communities.bmc.com/message/153415?tstart=0#1534152010-06-24T16:58:14Z8 years 7 months ago0Re: RSCD log for a yearhttps://communities.bmc.com/message/153412?tstart=0#153412
<!-- [DocumentBodyStart:6cca17cc-b918-4684-b19e-4ab62c25aede] --><div class="jive-rendered-content"><p>Nope, the customer actually doesn't have a syslog server. They want the logs for security and audit type activities. They also want keystroke logs to be available. How do we handle that on the BSARA side? Or does BSARA even handle it?</p><p style="min-height: 8pt; padding: 0px;">&#160;</p><p>About the collect agent logs script. Is it possible to change the location of where the files are getting dumped on the reports server? Currently it's on a local disk, we would like to move it to a NAS share. Is that possible? Has anyone done it? If so what are the steps? Just replace the "BASEDIR" variable within the script?</p></div><!-- [DocumentBodyEnd:6cca17cc-b918-4684-b19e-4ab62c25aede] -->Thu, 24 Jun 2010 16:52:14 GMTcommunities_update@bmc.comhttps://communities.bmc.com/message/153412?tstart=0#1534122010-06-24T16:52:14Z8 years 7 months ago10Re: RSCD log for a yearhttps://communities.bmc.com/message/153409?tstart=0#153409
<!-- [DocumentBodyStart:addf81e6-5de0-4186-8df8-5b9c416f79db] --><div class="jive-rendered-content"><p>Use a syslog host.&#160; The agent supports sending logs to syslog, then you configure syslog on the hosts to send to a remote host.&#160; If the customer has this requirement it's likely that they have a centralized log server already.</p></div><!-- [DocumentBodyEnd:addf81e6-5de0-4186-8df8-5b9c416f79db] -->Thu, 24 Jun 2010 16:38:14 GMTcommunities_update@bmc.comhttps://communities.bmc.com/message/153409?tstart=0#1534092010-06-24T16:38:14Z8 years 7 months ago20Re: RSCD log for a yearhttps://communities.bmc.com/message/153407?tstart=0#153407
<!-- [DocumentBodyStart:8f1dc909-b3e0-407d-add7-ae8efee19724] --><div class="jive-rendered-content"><p>Yes but collect_agent_logs is doing the same thing, why to rewrite the wheel. You just need to copy <strong>.</strong> from the destination directory of collect_agent_logs job to your logfile storage host/tape</p></div><!-- [DocumentBodyEnd:8f1dc909-b3e0-407d-add7-ae8efee19724] -->Thu, 24 Jun 2010 16:35:14 GMTcommunities_update@bmc.comhttps://communities.bmc.com/message/153407?tstart=0#1534072010-06-24T16:35:14Z8 years 7 months ago30Re: RSCD log for a yearhttps://communities.bmc.com/message/153388?tstart=0#153388
<!-- [DocumentBodyStart:b429f24d-f6a5-45a3-b39e-c4dce2813db6] --><div class="jive-rendered-content"><p>For security logging purposes, wouldn't it be better to copy the logs to a dedicated logfile storage host?</p></div><!-- [DocumentBodyEnd:b429f24d-f6a5-45a3-b39e-c4dce2813db6] -->Thu, 24 Jun 2010 16:17:29 GMTcommunities_update@bmc.comhttps://communities.bmc.com/message/153388?tstart=0#1533882010-06-24T16:17:29Z8 years 7 months ago40Re: RSCD log for a yearhttps://communities.bmc.com/message/153403?tstart=0#153403
<!-- [DocumentBodyStart:0e1e9d15-f847-4937-bbdb-062181a69c0b] --><div class="jive-rendered-content"><p>That should be for security and logging purpose Vivek. Umesh needs to set it for a year only, lucky you..</p><p style="min-height: 8pt; padding: 0px;">&#160;</p><p>My customer wants rscd logs for 7 years and appserver logs for ever.</p></div><!-- [DocumentBodyEnd:0e1e9d15-f847-4937-bbdb-062181a69c0b] -->Thu, 24 Jun 2010 16:04:14 GMTcommunities_update@bmc.comhttps://communities.bmc.com/message/153403?tstart=0#1534032010-06-24T16:04:14Z8 years 7 months ago50Re: RSCD log for a yearhttps://communities.bmc.com/message/153402?tstart=0#153402
<!-- [DocumentBodyStart:f5c8d5c7-64b1-4d18-8470-1ce6a351d033] --><div class="jive-rendered-content"><p>what kind of uses case we are trying to run here? Why would you need logs for one year?</p><p style="min-height: 8pt; padding: 0px;">&#160;</p><p>-Vivek</p></div><!-- [DocumentBodyEnd:f5c8d5c7-64b1-4d18-8470-1ce6a351d033] -->Thu, 24 Jun 2010 15:55:14 GMTcommunities_update@bmc.comhttps://communities.bmc.com/message/153402?tstart=0#1534022010-06-24T15:55:14Z8 years 7 months ago60Re: RSCD log for a yearhttps://communities.bmc.com/message/153377?tstart=0#153377
<!-- [DocumentBodyStart:d55ae049-fd3b-4ce5-b51b-4e3bee6a495a] --><div class="jive-rendered-content"><p>You will have to do a calculation in terms of size and timeframe and the amount of data you expect to be populated as rscd.log</p><p style="min-height: 8pt; padding: 0px;">&#160;</p><p>It works as whichever of the parameters value rolltimeinsec and rollsize reaches earlier, your rscd.log file is rolls back.</p><p style="min-height: 8pt; padding: 0px;">&#160;</p><p>You can run the collect agent logs to deal with this. But as soon as you bring those logs into BSARA DW, they are no more available as flat files. So before bringing the data into BSARA archive them at a separate location, if needed.</p></div><!-- [DocumentBodyEnd:d55ae049-fd3b-4ce5-b51b-4e3bee6a495a] -->Thu, 24 Jun 2010 14:48:14 GMTcommunities_update@bmc.comhttps://communities.bmc.com/message/153377?tstart=0#1533772010-06-24T14:48:14Z8 years 7 months ago70Re: RSCD log for a yearhttps://communities.bmc.com/message/153375?tstart=0#153375
<!-- [DocumentBodyStart:d02fe055-c360-4371-b8c6-636363bdc920] --><div class="jive-rendered-content"><p>why can't you run the collect agent logs and the associated ETL.&#160; that's a better way of handling this.</p><p style="min-height: 8pt; padding: 0px;">&#160;</p><p>otherwise you will have either a ton of files on your target or some huge log files.</p></div><!-- [DocumentBodyEnd:d02fe055-c360-4371-b8c6-636363bdc920] -->Thu, 24 Jun 2010 14:43:14 GMTcommunities_update@bmc.comhttps://communities.bmc.com/message/153375?tstart=0#1533752010-06-24T14:43:14Z8 years 7 months ago0RSCD log for a yearhttps://communities.bmc.com/message/153374?tstart=0#153374
<!-- [DocumentBodyStart:7cc71c39-9f06-4037-a439-1d26f5cc9654] --><div class="jive-rendered-content"><p>I'm trying to modify the log4crc.txt file on 7.6 agents to make sure we have 1 year worth of logging. I see the following line that controls this:</p><p style="min-height: 8pt; padding: 0px;">&#160;</p><p>&lt;appender name="/usr/nsh/log/rscd.log" type="rollfile" rollsize="####" rolltimeinsec="####" rollmaxfiles="10" layout="dated"&gt;</p><p style="min-height: 8pt; padding: 0px;">&#160;</p><p>Here, I'm trying to modify the rollsize, rolltimeinsec and rollmaxfiles to make sure we have 1 year worth of logs. What are values that would make this happen? Is it as simple as # seconds in a year for rolltimeinsec? (31622400 seconds based on a leap year).</p><p style="min-height: 8pt; padding: 0px;">&#160;</p><p>Any help will be appreciated!</p></div><!-- [DocumentBodyEnd:7cc71c39-9f06-4037-a439-1d26f5cc9654] -->Thu, 24 Jun 2010 14:38:23 GMTcommunities_update@bmc.comhttps://communities.bmc.com/message/153374?tstart=0#1533742010-06-24T14:38:23Z8 years 7 months ago90